@hiiretail/gcp-infra-cli 0.92.5 → 0.93.1

package/generators/common-resources/cloud-armor/generator.json

@@ -0,0 +1,4 @@
+{
+  "name": "Cloud Armor",
+  "description": "Create a cloud armor policy"
+}

package/generators/common-resources/cloud-armor/index.js

@@ -0,0 +1,45 @@
+const path = require('path');
+const chalk = require('chalk');
+const BaseGenerator = require('../../../src/BaseGenerator');
+const getTribeAndClanName = require('../../init/clan-infra/tribe-clan-repo');
+
+module.exports = class extends BaseGenerator {
+  prompting() {
+    const prompts = [
+      {
+        type: 'input',
+        name: 'name',
+        default: getTribeAndClanName().clan,
+        message: 'Enter your policy name or leave blank for default',
+      },
+    ];
+    return this.prompt(prompts).then((props) => {
+      this.answers = props;
+    });
+  }
+
+  writing() {
+    const {
+      name,
+    } = this.answers;
+
+    const run = (env) => {
+      this.copyDir(
+        path.join(''),
+        path.join('infra', env, 'cloud-armor', name),
+      );
+    };
+    run('staging');
+    run('prod');
+  }
+
+  end() {
+    const {
+      name,
+    } = this.answers;
+    this.log(`
+${chalk.green(`Your cloud armor policy ${chalk.cyan(name)} has been created. To finalize your configuration, please continue
+with manual editing of the generated files.`)}
+`);
+  }
+};

package/generators/common-resources/cloud-armor/templates/policies.yaml

@@ -0,0 +1,49 @@
+##  This yaml file will configure your cloud armor policies
+##  For more information on how to configure the expressions
+##  Visit https://cloud.google.com/armor/docs/rules-language-reference
+description: Cloud armor policy
+default-action: allow ## if no requests match any rules this value will be honored ( allow | deny )
+rules:
+  deny-no-auth-header:
+    action: deny
+    priority: 10
+    description: Block requests without auth header
+    preview: true ## dry run true | false
+    ## Expression will block any request not containing the authorization header
+    expression: >-
+      !has(request.headers["authorization"])
+
+  ## Example rules
+  # ban-requests:
+  #   action: rate_based_ban
+  #   priority: 500
+  #   description: ban requests if more then 10 with the same authorization token
+  #   preview: true
+  #   expression: >-
+  #     inIpRange(origin.ip, "0.0.0.0/0") && has(request.headers["authorization"])
+  #   rate_limit_options:
+  #     exceed_action: deny(502)
+  ## Ban if we get more than 10 requests in 10 minutes for 40 minutes
+  #     ban_http_request_count: 10
+  #     ban_http_request_interval_sec: 600
+  #     ban_duration_sec: 2700
+  ## Throttle if we get more than 5 requests every 60 seconds
+  #     rate_limit_http_request_count: 5
+  #     rate_limit_http_request_interval_sec: 60
+  ## Enforce on auth header only
+  #     enforce_on_key_configs:
+  #       - enforce_on_key_type: HTTP_HEADER
+  #         enforce_on_key_name: authorization
+  # throttle-requests:
+  #   action: throttle
+  #   priority: 1000
+  #   description: throttle requests from SE (100/minute)
+  #   preview: true
+  #   expression: >-
+  #     inIpRange(origin.ip, "0.0.0.0/0") && origin.region_code == "SE"
+  #   rate_limit_options:
+  #     exceed_action: deny(429)
+  ## Throttle if we get 100 requests per minute from sweden and the same IP
+  #     rate_limit_http_request_count: 100
+  #     rate_limit_http_request_interval_sec: 60
+  #     enforce_on_key: ALL

package/generators/common-resources/cloud-armor/templates/terragrunt.hcl

@@ -0,0 +1,30 @@
+# Terragrunt will copy the Terraform configurations specified by the source parameter, along with any files in the
+# working directory, into a temporary folder, and execute your Terraform commands in that folder.
+terraform {
+  source = "git::https://github.com/GoogleCloudPlatform/terraform-google-cloud-armor//?ref=v2.0.1"
+}
+
+include {
+  path = find_in_parent_folders("terragrunt_root.hcl")
+}
+
+locals {
+  project_vars = read_terragrunt_config(find_in_parent_folders("project.hcl"))
+  common_vars  = read_terragrunt_config(find_in_parent_folders("common.hcl"))
+  policies     = yamldecode(file("${get_terragrunt_dir()}/policies.yaml"))
+  name         = basename(get_terragrunt_dir())
+}
+
+inputs = merge(
+  {
+    project_id                           = local.project_vars.locals.project_id
+    name                                 = local.name
+    description                          = local.policies["description"]
+    default_rule_action                  = local.policies["default-action"]
+    type                                 = "CLOUD_ARMOR"
+    layer_7_ddos_defense_enable          = false
+    json_parsing                         = "STANDARD"
+    log_level                            = "VERBOSE"
+    custom_rules                         = local.policies["rules"]
+  }
+)

package/generators/docs/rca/templates/docs/rca_external.md

@@ -11,9 +11,11 @@ shared with external customers as well as internal stakeholders. Some guidelines
 * Include what the problem was and how the customer(s) was affected
 * Do NOT include any customer names
 * Do NOT include any Hii Retail service names or underlying technologies that we are using
-* Include some general action points, such as if additional alerts needs to be added. Skip the details
+* Include some general action points, such as if additional alerts needs to be added. Do not add details
 * Don't make promises, if there are any actions that we will look at, just mention them. Don't include target dates
 
 Example:
 On January 25 2023 from 14:31 CET to 15:59 CET some customers may have experienced delays with card payments. The issue was traced back to a misconfiguration of a recent deployment. At 15:31 CET a fix was deployed and monitored. At 15:59 CET the issue was resolved for all affected customers.
+
+We will look into the process of how we update our configuration in production to mitigate these issues going forward.
 -->

package/generators/docs/rca/templates/docs/rca_internal.md

@@ -12,9 +12,15 @@
 
 **Impact to customer**: <!-- Describe how the customer, and end customers, was affected by the incident. Where they completely unable to use the system? Or was there some feature that wasn't working? -->
 
-**Ticket information**: <!-- Add link(s) to any Jira issues -->
+**Ticket information**:
 
-**Services involved**: <!-- List the Hii Retail-service(s) that were involved in the incident, for example checkout-poslog -->
+<!-- Add link(s) to any Jira issues in the format of:
+
+  - [EXTINTERAL-1234](https://extendaretail.atlassian.net/browse/EXTINTERAL-1234)
+
+-->
+
+**Services involved**: <!-- List the Hii Retail-service(s) that were involved in the incident, for example checkout-poslog. If multiple services/systems are involved, just mention the systems such as: Checkout Engine, Store Data etc. -->
 
 ## Summary
 
@@ -31,10 +37,10 @@ Describe the events that caused the incident, starting from when the issues star
 
 Example:
 
-  - 2022-06-14 14.36 - Alert X was triggered
-  - 2022-06-14 14.36 - Team started working on the incident
-  - 2022-06-14 14.49 - A fix was pushed and deployed
-  - 2022-06-14 14.53 - Incident was resolved
+  - 2024-03-27 14.36 CET - Alert X was triggered
+  - 2024-03-27 14.36 CET - Team started working on the incident
+  - 2024-03-27 14.49 CET - A fix was pushed and deployed
+  - 2024-03-27 14.53 CET - Incident was resolved
 -->
 
 ## Five Whys
@@ -42,9 +48,11 @@ Example:
 <!--
 Five whys is a technique used to explore the cause and effect underlying a particular problem. The primary goal of the technique is to determine the root cause of a problem by repeating the question "Why?". Each answer forms the basis of the next question.
 
+Note: It is not a requirement to add exactly 5 whys. If the root cause is found at the third why, it is not necessary to continue. The main point is to find the root cause within 5 steps.
+
 Example:
 
-Problem: The vehicle won't start
+**Problem**: The vehicle won't start
 
   1. __Why?__ - The battery is dead (First why)
   2. __Why?__ - The alternator is not functioning (Second why)
@@ -53,6 +61,8 @@ Problem: The vehicle won't start
   5. __Why?__ - The vehicle was not maintained according to the recommended service schedule. (Fifth why, the root cause)
 -->
 
+**Problem**:
+
   1. __Why?__
   2. __Why?__
   3. __Why?__

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hiiretail/gcp-infra-cli",
-  "version": "0.92.5",
+  "version": "0.93.1",
   "description": "Infrastructure as code generator for GCP.",
   "main": "src/cli.js",
   "bin": {